Merge pull request Unidata#4019 from dopplershift/update-actions

Update GitHub Actions configurations

Author: dcamron

.github/actions/build-docs/action.yml

@@ -59,7 +59,7 @@ runs:
 
     - name: Upload docs as artifact
       if: ${{ always() && inputs.key != '' }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:
         name: ${{ inputs.key }}-docs
         path: |

.github/actions/install-conda/action.yml

@@ -16,7 +16,7 @@ runs:
   using: composite
   steps:
     - name: Set up Python ${{ inputs.python-version }}
-      uses: mamba-org/setup-micromamba@v2
+      uses: mamba-org/setup-micromamba@add3a49764cedee8ee24e82dfde87f5bc2914462 # v2.0.7
       with:
         # Name is needed for caching
         environment-name: CI

.github/actions/install-pypi/action.yml

@@ -28,7 +28,7 @@ runs:
   using: composite
   steps:
     - name: Set up Python ${{ inputs.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ inputs.python-version }}
         cache: 'pip'

.github/actions/run-tests/action.yml

@@ -44,14 +44,14 @@ runs:
 
     - name: Upload test images
       if: failure()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:
         name: ${{ inputs.key }}-images
         path: test_output/
 
     - name: Upload coverage artifact
       if: ${{ inputs.upload-coverage == 'true' }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:
         name: ${{ inputs.key }}
         path: coverage.xml

.github/dependabot.yml

@@ -6,6 +6,8 @@ updates:
     directory: "/ci"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 2
     # Boto3 makes patch releases daily, so ignore those to reduce the noise
     ignore:
       - dependency-name: "boto3"
@@ -32,6 +34,8 @@ updates:
     directory: "/ci-dev"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 2
     # We don't need to worry about updating to every patch release of dev tools
     ignore:
       - dependency-name: "*"
@@ -59,6 +63,8 @@ updates:
       - "/.github/actions/*"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 2
     open-pull-requests-limit: 10
     pull-request-branch-name:
       separator: "-"

.github/workflows/assign-milestone.yml

@@ -15,7 +15,7 @@ jobs:
     name: Assign Latest Milestone
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         name: Run script
         with:
           script: |

.github/workflows/automerge-dependabot.yml

@@ -10,6 +10,7 @@ jobs:
   Backport:
     environment:
       name: PR Backport
+      deployment: false
     runs-on: ubuntu-slim
     if: github.event.pull_request.merged && contains( github.event.pull_request.labels.*.name, 'backport' )
     permissions:
@@ -21,7 +22,7 @@ jobs:
 
     steps:
       - name: Create App Token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -39,7 +40,7 @@ jobs:
           git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
 
       - name: Checkout PR HEAD
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 100
@@ -60,7 +61,7 @@ jobs:
 
       - name: Create backport PR
         id: create-pr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           title: '${{ github.event.pull_request.title }} (backport)'
@@ -72,13 +73,13 @@ jobs:
           delete-branch: true
           labels: 'backported-pr,${{ join(github.event.pull_request.labels.*.name) }}'
 
-      - uses: actions-ecosystem/action-remove-labels@v1
+      - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
         with:
           number: ${{ steps.create-pr.outputs.pull-request-number }}
           labels: backport
 
       - name: Comment on completion
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             github.rest.issues.createComment({
@@ -90,7 +91,7 @@ jobs:
 
       - name: Comment on error
         if: failure()
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const workflow_url = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;

.github/workflows/backport-prs.yml

@@ -6,28 +6,30 @@ on:
     types: [opened, synchronize, reopened, labeled] #defaults and when labeled
   workflow_dispatch:
 
-
 concurrency:
   group: ${{ github.workflow}}-${{ github.head_ref }}
   cancel-in-progress: true
 
 jobs:
   benchmark:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     #sets only to run when the GitHub PR is labeled with 'benchmark'
     if: contains(github.event.pull_request.labels.*.name, 'benchmark')
     timeout-minutes: 20  #times out after 20 minutes
     defaults: 
       run: 
         working-directory: ./benchmarks #sets the default working directory to ./benchmarks 
     steps:
-          - uses: actions/setup-python@v6  #sets up python with version 3.12
+          - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
             with:
               python-version: "3.12"
           - name: Checkout repo
-            uses: actions/checkout@v6  #checks out repository
+            uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
             with:
               fetch-depth: 0  # Fetch full history
+              persist-credentials: false
           - run: python -m pip install numpy pandas xarray metpy netcdf4
           - name: Create data array
             run: python data_array_generate.py

.github/workflows/benchmark-pr.yml

@@ -15,13 +15,15 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out a copy of the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Check validity of CITATION.cff
-        uses: citation-file-format/cffconvert-github-action@2.0.0
+        uses: citation-file-format/cffconvert-github-action@4cf11baa70a673bfdf9dad0acc7ee33b3f4b6084 # 2.0.0
         with:
           args: "--validate"